A stolen work laptop: replace the device, but assess the data exposure too
Hardware theft and a potential personal-data breach need parallel responses. Establish encryption, access and evidence before drawing conclusions.
One missing object, two different loss questions
A stolen work laptop may be worth less than the information and access it carries. Buying another device restores hardware, not necessarily control over copied files, saved credentials or customer data. Treat the event as both a property incident and a security assessment. The official guidance reviewed on 14 October 2026 recommends device protection and explains personal-data breach notification criteria. Theft does not automatically prove that data was read, but it is not evidence that data stayed safe either. Record what is known, what can be verified and what remains uncertain instead of announcing either a catastrophe or complete reassurance.
Establish the device's state when it disappeared
Identify the asset, user, time, location, last known session state and data held locally. Ask the authorised IT team to verify full-disk encryption, authentication, remote-management status and relevant access logs. A sticker saying secure is not proof that encryption was active, and a locked screen is not the same control as disk encryption. Assess saved browser sessions, synchronised folders and removable storage separately. Record actions and timestamps. Do not improvise destructive commands; remote locking or wiping should follow the approved incident procedure, with evidence preserved and the implications understood. Report physical theft through the competent police channel.
A hypothetical cost comparison
Imagine the replacement laptop costs CHF 1,500. An incident specialist estimates CHF 2,000 for assessment and access remediation, while the business loses CHF 1,200 of margin during disruption. The illustrative total is CHF 4,700, but these categories may involve separate policies, deductibles and approval requirements. Suppose verified encryption and authentication make exposure unlikely: the assessment can be proportionate. Suppose instead the machine was unlocked with customer files accessible: a broader response may be necessary. Neither scenario determines the insurer's answer. The example shows why the hardware invoice is a poor proxy for the whole incident and why confirmed controls can change the practical response.
Coordinate insurance and legal duties without delay
Contact the relevant property insurer and cyber response line, explaining the facts and asking which vendors and costs require approval. Do not assume cyber cover automatically replaces stolen hardware or that property cover funds legal breach analysis. Under the Swiss data-protection framework, notification to the PFPDT depends on the applicable high-risk assessment, not simply the price of the missing device. Obtain qualified help where personal data may be affected; statutory duties should not wait for coverage acceptance. Consider cross-border requirements separately if relevant. Share evidence securely, limiting broad circulation of customer lists or sensitive files while trying to investigate their loss.
Turn the findings into a mobile-work control
After containment, confirm which access was revoked, whether backups restored the required data and what the assessment concluded. Record the decision on notifications and the basis for it. Update asset inventory, encryption checks and staff instructions around unattended devices, transport and secure storage. Reducing local data can limit exposure, while remote access still needs proper authentication. A stricter process adds inconvenience, so make the approved method usable rather than encouraging informal workarounds. Review claim reimbursement against actual costs once the incident closes. A stolen laptop is manageable only when replacement, data risk and continuity are treated as distinct responsibilities.
Sources and further reading
Original Clearwise analysis. External reporting provides context; rules and contract terms must be verified with the competent authority or provider. Some press articles may require a subscription.
Apply this to your situation
Compare your actual documents and clarify what matters before making a commitment.
Request a free consultationGeneral guidance, not a binding quote or personalised legal, tax or investment advice. Examples are hypothetical and results are not guaranteed.
